@upyo/smtp 0.5.3 → 0.5.4

package/dist/index.cjs

@@ -1164,6 +1164,8 @@ function arrayBufferToBase64(buffer) {
 * @returns The converted SMTP message.
 * @throws {RangeError} If a header contains a token that cannot be folded
 * within the RFC 5322 hard line-length limit.
+* @throws {TypeError} If a `Date` or `Message-ID` header supplied by the
+* message contains a carriage return or line feed.
 */
 async function convertMessage(message, dkimConfig) {
 	const envelope = {
@@ -1201,14 +1203,29 @@ async function buildRawMessage(message) {
 	if (message.ccRecipients.length > 0) lines.push(foldHeader("Cc", message.ccRecipients.map(encodeAddress).join(", ")));
 	if (message.replyRecipients.length > 0) lines.push(foldHeader("Reply-To", message.replyRecipients.map(encodeAddress).join(", ")));
 	lines.push(foldHeader("Subject", encodeHeaderValue(message.subject, true)));
-	lines.push(`Date: ${(/* @__PURE__ */ new Date()).toUTCString()}`);
-	lines.push(`Message-ID: <${generateMessageId()}>`);
+	lines.push(foldHeader("Date", overridden(message, "Date") ?? (/* @__PURE__ */ new Date()).toUTCString()));
+	lines.push(foldHeader("Message-ID", overridden(message, "Message-ID") ?? `<${generateMessageId()}>`));
+	const composed = new Set([
+		"from",
+		"to",
+		"cc",
+		"reply-to",
+		"subject",
+		"date",
+		"message-id"
+	]);
 	if (message.priority !== "normal") {
 		const priorityValue = message.priority === "high" ? "1" : "5";
 		lines.push(`X-Priority: ${priorityValue}`);
 		lines.push(`X-MSMail-Priority: ${message.priority === "high" ? "High" : "Low"}`);
+		composed.add("x-priority");
+		composed.add("x-msmail-priority");
+	}
+	for (const [key, value] of message.headers) {
+		const name = key.toLowerCase();
+		if (composed.has(name) || reservedHeaders.has(name)) continue;
+		lines.push(foldHeader(key, encodeHeaderValue(value)));
 	}
-	for (const [key, value] of message.headers) lines.push(foldHeader(key, encodeHeaderValue(value)));
 	lines.push("MIME-Version: 1.0");
 	if (isMultipart) {
 		lines.push(`Content-Type: multipart/mixed; boundary="${boundary}"`);
@@ -1271,6 +1288,41 @@ async function buildRawMessage(message) {
 	}
 	return lines.join("\r\n");
 }
+/**
+* Reads a header field that overrides a generated default.
+*
+* Unlike custom headers, the value is written verbatim rather than RFC 2047
+* encoded, so it cannot rely on `encodeHeaderValue()` to neutralize control
+* characters.  `ImmutableHeaders` is a structural type, so a `Message` may
+* carry an adapter that never rejected CR or LF the way a platform `Headers`
+* does.
+*
+* @param message The message whose headers are read.
+* @param name The header field name.
+* @returns The supplied value, or `undefined` when the message has none.
+* @throws {TypeError} If the value contains a carriage return or line feed,
+* which would inject additional header fields into the message.
+*/
+function overridden(message, name) {
+	const value = message.headers.get(name);
+	if (value == null) return void 0;
+	if (/[\r\n]/.test(value)) throw new TypeError(`Header field ${name} must not contain a carriage return or line feed.`);
+	return value;
+}
+/**
+* Header fields the composer owns but writes after the custom headers, or
+* deliberately omits.  A custom header with one of these names is dropped
+* rather than appended: the structured `Message` fields are authoritative,
+* RFC 5322 §3.6 allows at most one of each, and a duplicate placed before the
+* composer's own field makes parsers that take the first occurrence read the
+* wrong value.
+*/
+const reservedHeaders = new Set([
+	"bcc",
+	"content-transfer-encoding",
+	"content-type",
+	"mime-version"
+]);
 function generateBoundary() {
 	return `boundary-${Date.now()}-${Math.random().toString(36).substr(2, 9)}`;
 }

package/dist/index.js

@@ -1141,6 +1141,8 @@ function arrayBufferToBase64(buffer) {
 * @returns The converted SMTP message.
 * @throws {RangeError} If a header contains a token that cannot be folded
 * within the RFC 5322 hard line-length limit.
+* @throws {TypeError} If a `Date` or `Message-ID` header supplied by the
+* message contains a carriage return or line feed.
 */
 async function convertMessage(message, dkimConfig) {
 	const envelope = {
@@ -1178,14 +1180,29 @@ async function buildRawMessage(message) {
 	if (message.ccRecipients.length > 0) lines.push(foldHeader("Cc", message.ccRecipients.map(encodeAddress).join(", ")));
 	if (message.replyRecipients.length > 0) lines.push(foldHeader("Reply-To", message.replyRecipients.map(encodeAddress).join(", ")));
 	lines.push(foldHeader("Subject", encodeHeaderValue(message.subject, true)));
-	lines.push(`Date: ${(/* @__PURE__ */ new Date()).toUTCString()}`);
-	lines.push(`Message-ID: <${generateMessageId()}>`);
+	lines.push(foldHeader("Date", overridden(message, "Date") ?? (/* @__PURE__ */ new Date()).toUTCString()));
+	lines.push(foldHeader("Message-ID", overridden(message, "Message-ID") ?? `<${generateMessageId()}>`));
+	const composed = new Set([
+		"from",
+		"to",
+		"cc",
+		"reply-to",
+		"subject",
+		"date",
+		"message-id"
+	]);
 	if (message.priority !== "normal") {
 		const priorityValue = message.priority === "high" ? "1" : "5";
 		lines.push(`X-Priority: ${priorityValue}`);
 		lines.push(`X-MSMail-Priority: ${message.priority === "high" ? "High" : "Low"}`);
+		composed.add("x-priority");
+		composed.add("x-msmail-priority");
+	}
+	for (const [key, value] of message.headers) {
+		const name = key.toLowerCase();
+		if (composed.has(name) || reservedHeaders.has(name)) continue;
+		lines.push(foldHeader(key, encodeHeaderValue(value)));
 	}
-	for (const [key, value] of message.headers) lines.push(foldHeader(key, encodeHeaderValue(value)));
 	lines.push("MIME-Version: 1.0");
 	if (isMultipart) {
 		lines.push(`Content-Type: multipart/mixed; boundary="${boundary}"`);
@@ -1248,6 +1265,41 @@ async function buildRawMessage(message) {
 	}
 	return lines.join("\r\n");
 }
+/**
+* Reads a header field that overrides a generated default.
+*
+* Unlike custom headers, the value is written verbatim rather than RFC 2047
+* encoded, so it cannot rely on `encodeHeaderValue()` to neutralize control
+* characters.  `ImmutableHeaders` is a structural type, so a `Message` may
+* carry an adapter that never rejected CR or LF the way a platform `Headers`
+* does.
+*
+* @param message The message whose headers are read.
+* @param name The header field name.
+* @returns The supplied value, or `undefined` when the message has none.
+* @throws {TypeError} If the value contains a carriage return or line feed,
+* which would inject additional header fields into the message.
+*/
+function overridden(message, name) {
+	const value = message.headers.get(name);
+	if (value == null) return void 0;
+	if (/[\r\n]/.test(value)) throw new TypeError(`Header field ${name} must not contain a carriage return or line feed.`);
+	return value;
+}
+/**
+* Header fields the composer owns but writes after the custom headers, or
+* deliberately omits.  A custom header with one of these names is dropped
+* rather than appended: the structured `Message` fields are authoritative,
+* RFC 5322 §3.6 allows at most one of each, and a duplicate placed before the
+* composer's own field makes parsers that take the first occurrence read the
+* wrong value.
+*/
+const reservedHeaders = new Set([
+	"bcc",
+	"content-transfer-encoding",
+	"content-type",
+	"mime-version"
+]);
 function generateBoundary() {
 	return `boundary-${Date.now()}-${Math.random().toString(36).substr(2, 9)}`;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@upyo/smtp",
-  "version": "0.5.3",
+  "version": "0.5.4",
   "description": "SMTP transport for Upyo email library",
   "keywords": [
     "email",
@@ -53,7 +53,7 @@
   },
   "sideEffects": false,
   "peerDependencies": {
-    "@upyo/core": "0.5.3"
+    "@upyo/core": "0.5.4"
   },
   "devDependencies": {
     "tsdown": "^0.12.7",